code-video
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies heavily on system tools for media manipulation. Multiple scripts (
scripts/tts.py,scripts/sync_check.py,scripts/audio_check.sh,scripts/check_video.sh, andscripts/contact_sheet.sh) invokeffmpegandffprobevia subprocess calls to encode video, extract audio, and validate media properties. These operations are consistent with the skill's primary function of video production. - [EXTERNAL_DOWNLOADS]: Several dependencies listed in
requirements.txtinvolve network access: edge-ttsconnects to Microsoft's speech platform (speech.platform.bing.com) to generate narration.faster-whisperis configured to download pre-trained machine learning models from official Hugging Face repositories (Systran/faster-whisper-base.en,Systran/faster-whisper-small) for transcription and verification tasks.- [DYNAMIC_EXECUTION]: The rendering pipeline in
scripts/capture.mjsutilizes dynamic execution to capture video frames: - It spawns a local HTTP server on a random loopback port (
127.0.0.1) to serve the project files, with built-in path-traversal protection ensuring only the designated project directory is accessible. - It uses headless browser automation (Playwright or Puppeteer) to load the project and executes user-defined rendering code via
page.evaluate, which is the intended mechanism for frame-by-frame capture.
Audit Metadata